Group Reporting - Authorizations

Comprehensive Guide to Authorization Object E_CS_RPT in SAP Group Reporting

The Authorization Object E_CS_RPT is integral to SAP Group Reporting, specifically for controlling access to data related to organizational units. This authorization object ensures that users can access only the required data segments in analytics, enhancing data security and promoting efficient access management. Here, we explore the fields, dependencies, maintenance, and activation of E_CS_RPT, along with insights into related authorization objects.

---

Overview of Authorization Object E_CS_RPT

• Purpose: Manages access to organizational unit data within SAP Group Reporting analytics.
• Scope: Ensures controlled access based on parameters like consolidation unit, consolidation group, and specific financial dimensions.
• Activation: Requires activation through the Switchable Authorization Check Framework (SACF).

---

Key Fields in E_CS_RPT

The authorization object E_CS_RPT includes several essential fields that enable precise control over data access within group reporting. Each field is tailored to specific data aspects:

1. RVERS (Consolidation Version): Defines the version of the data, crucial for tracking different versions of financial statements and reports.
2. CONGR ($CONGR) - Consolidation Group: Controls access to specific consolidation groups, enabling users to access data for the specified groups only.
3. BUNIT ($BUNIT) - Consolidation Unit: Determines access to specific consolidation units within a group.
4. PRCTR ($PRCTER) - Profit Center: Restricts access to profit center data, essential for segmenting financial data.
5. KOKRS ($KOKRS) - Controlling Area: Limits access by controlling area, ensuring region-specific data segmentation.
6. SEGMENT: Enables access restrictions based on segmental reporting requirements.
7. FICSDOCTY - Document Type: Controls access to specific document types, useful for managing access to financial documents.
8. RITEM - Financial Statement Item: Limits access to financial statement items, critical for financial reporting.
9. FICSPSTLV - Posting Level: Controls data access based on posting levels, essential for defining transaction hierarchies.
10. ACTVT - Activity: Specifies authorized actions like display, edit, or execute.

---

Dependencies Between Fields

The E_CS_RPT authorization object includes dependencies between fields, enabling the creation of complex authorization scenarios. For instance:

• Multi-Group Dependency: A consolidation unit may belong to multiple consolidation groups, and each group could apply in several consolidation versions.
• Example Scenario:
  • Consolidation Groups: Cons Group A and Cons Group B.
  • Consolidation Units: Cons Unit 1 and Cons Unit 2.
  • Requirement: Allow a user access to all data in Cons Unit 1 across both groups (A and B) and restrict Cons Unit 2 access only to Group A.
    • Solution:
      • Maintain Cons Unit 1 in BUNIT ($BUNIT) with * in CONGR ($CONGR).
      • For Cons Unit 2, specify BUNIT ($BUNIT) as Cons Unit 2 and CONGR ($CONGR) as Cons Group A only.

Maintaining Fields in E_CS_RPT

Maintenance of fields in E_CS_RPT enables targeted data access control:

• Field Values: Maintain specific values for each field to restrict user access precisely.
• Full Authorization: Use * to grant unrestricted access across all values within a field.
• Empty Field Value '': Define fields as empty to apply access for data segments stored without specific values (important for data on posting levels Blank, 00, 10, and 20).

Example:

If CONGR ($CONGR) is maintained as * (all groups), the user receives access to all consolidation groups, including cases with no specific group derivation.

Special Case for BUNIT and Posting Level 20

For BUNIT ($BUNIT) at Posting Level 20:

• Only data where the specified BUNIT is the reporting unit will be accessible. Partner unit data will not be accessible unless explicitly authorized.

Illustration:

• Consolidation Group A has transactions where:
  • Reporting Unit: Cons Unit 1.
  • Partner Unit: Cons Unit 2.
  • Only transactions with Cons Unit 1 as the reporting unit will be visible.

Activating E_CS_RPT with the Switchable Authorization Check Framework (SACF)

To implement E_CS_RPT, activation via the SACF is necessary. This framework enables selective control over the activation of authorization checks, providing flexibility to toggle checks as required.

• Steps:
  • Refer to SAP Note 3120976 for step-by-step instructions on activation.

---

Related Authorization Objects in SAP Group Reporting

In addition to E_CS_RPT, SAP Group Reporting includes several other authorization objects that cater to different aspects of data access and control:

Authorization Object	Description
E_CS_BUNIT	Access to consolidation unit master data.
E_CS_CACTT	Task execution for specified consolidation units/groups.
E_CS_CONGR	Access to consolidation group master data.
E_CS_DIMEN	Full dimension access (e.g., dimension Y1).
E_CS_ITCLG	Controls access to consolidated chart of accounts.
FI_CS_RPT	Similar to E_CS_RPT but specific to reporting within Group Reporting.

For further understanding, refer to Transaction PFCG in SAP, where documentation on each object can be accessed.

---

Conclusion

The authorization object E_CS_RPT is essential in managing access control within SAP Group Reporting. By understanding its fields, dependencies, and maintenance options, organizations can establish granular access controls tailored to specific reporting needs. Furthermore, activating E_CS_RPT through the SACF framework ensures flexibility in enabling or disabling these checks, providing adaptable security and efficiency in reporting.